Where your data lives

Everything you enter (income, bills, accounts, debts, assets, versions) is stored in a Postgres database run by Supabase, in Frankfurt, Germany (EU region eu-central-1).

• Each account can read only its own data. That is enforced by the database itself (row-level security), not by the app hiding it.
• It is encrypted in transit (TLS) and at rest (AES-256).
• Sign-in and passwords are handled by Supabase Auth. We never see your password.
• The app also keeps a copy of your plan on your own device so it opens quickly. Signing out deletes it.

The CrestCast web app and this website are hosted on Vercel. Vercel serves the code; your plan is not stored there.

Subscriptions are handled by Stripe. CrestCast never sees your card details: Stripe gives us a customer id and whether the subscription is active.

Set up by chatting and Ask or try a what-if are optional, and used only when you choose to use them. Everything else works without them.

• When you send a message, it goes to Anthropic with the figures needed to answer it, and Anthropic can process it in the United States.
• Under its commercial terms Anthropic does not train its models on it, and deletes it within 30 days unless its usage policy or the law requires longer.
• CrestCast stores no conversation, only a record of how much was used.
• Nothing the assistant drafts goes into your plan until you add it.

The full detail of what is sent is in the privacy policy.

• A partner sees joint finances, which belong to both of you. Your own tab stays private unless you choose Viewing, or Viewing and editing, in Settings.
• An adviser you invite sees the figures you have entered and your forecast, view only unless you switch on Can edit, and nothing your partner has entered.
• You can change or stop either at any time, and it takes effect immediately.

• No bank connection. Nothing is pulled in from your bank; a CSV you export yourself is read on your own device.
• No selling your data, and no advertising.
• No analytics on your figures. This website counts page views with Vercel's cookieless analytics, and uses Google Analytics only if you accept it.